CVE-2026-68351

In the Linux kernel, the following vulnerability has been resolved:

wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read

When the firmware sends a command response with a length mismatch,

carl9170_cmd_callback() logs the mismatch and calls carl9170_restart()

but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4).

Since len comes from the firmware and can exceed ar->readlen, this

copies more data than the readbuf was allocated for.

Bound the memcpy to min(len - 4, ar->readlen) so that the response

is still completed -- avoiding repeated restarts from queued garbage --

while preventing an overread past the response buffer.